Re:Brute forcing JSON Web Tokens in C
by nrjdhsbsid on Sunday January 22, 2017 @04:26PM
(#13457590)
Signing jwt with RSA is a bad idea. Asymmetrical encryption methods are orders of magnitude slower than hmac. It sounds like a nice thing to do but it's really really slow compared to hmac.
That's why TLS only uses the public key to exchange a symmetric key then switches over to AES or whatever.
That's why TLS only uses the public key to exchange a symmetric key then switches over to AES or whatever.